Enabling Access for Trusted Devices

After you have established device trust and configured your threat and risk policies, you are ready to provide those "sanctioned and secured" devices with secure access to your company resources.

The Trusted Access solution calls for the use of Jamf Connect, Jamf's cloud-native Zero Trust Network Access product, to faciliate high-performance and user-friendly connectivity while delivering advanced network security capabilities for any SaaS, private cloud, or on-prem application.

You may also use partner integrations that utilize API signaling to indicate a given device's management and compliance state. These integrations only apply to a subset of applications, and may be used instead of or in addition to Jamf Connect depending on your requirements.

For macOS devices, you are able to further configure Partner Conditional Access via Jamf Pro to enable those partner services to allow or deny access based upon device compliance state (e.g. Smart Group membership).

Deploying Jamf Connect

By deploying Jamf Connect, you are creating a trusted and private network path between managed endpoints and all of your organization's applications.

Follow these steps to get Jamf Connect up and running in your environment to establish fast and secure connectivity:

1. Review and understand the Jamf Connect Architecture, or watch this 20-minute JNUC'21 video introducing you to it.

2. Login to your Jamf Security Cloud account and link your identity provider to allow end users to activate Private Access via the Jamf Trust app using their corporate credentials.

3. Create an Activation Profile that configures the Network Access, Content Controls and Security service capabilities and utilizes your identity provider for authentication.
   

   1. Make sure you disable Identity-based Provisioning for your newly created activation profile. This will ensure only managed devices may activate using it.
   2. You may create other Activation Profiles that do use this feature to cover contractor devices or other devices that cannot be enrolled to MDM, but should only have very narrow access instead.

4. Define device groups that will be used to map users and their devices to specific apps they should (or should not) be able to access (e.g. "Executives", "Engineering", "Sales")

5. Configure integration with Jamf Pro.

   1. Configure group mapping to map Jamf Pro Smart Groups to the appropriate groups you defined above.
   2. (Optional) Definedevice field mappings as appropriate.

6. Establish secure access to your applications and data resources by configuring one or more private interconnect gateways between the Jamf Security Cloud and your data center(s) and private cloud(s).

7. Configure Custom DNS zone(s) if you use an internal domain name server or split-brain DNS to reach internal resources.

8. Configure Access Policies that define your organization's applications, their access policies, and reachability (either via the public internet or a configured private interconnect gateway).

   1. If the app you are defining contains sensitive data, be sure to limit access to only the groups that need to access in the Users and Groups tab, and define the maximum tolerable risk level in the Security tab of the access policy.
   2. Note: you can customize the severity of each threat category that determines a device's risk score using RADAR's security policy configuration.

9. Deploy Jamf Trust to Devices (the Jamf Connect endpoint agent) using Jamf Pro or other applicable device managment tools for your enrolled devices' platforms.

   1. For BYOD iOS/iPadOS devices, be sure to follow the specific "Deploy Jamf Trust" instructions in the User Enrollment article.

When Jamf Connect is properly deployed and configured, all enterprise application connectivity is encrypted to the Jamf Security Cloud and subject to access policies that have been defined.

For a techical under-the-hood explanation of how Private Access works, check out our Network Engineer's Guide to Private Access.

Partner Management State Integrations

While Jamf Connect is used to enable network-based connectivity and access control to any TCP or UDP application – including SaaS and private on-premise apps – it is possible to signal a device's management state and other metadata via integrations with select partners.

This allows the parter's platform to determine if a given device is managed by Jamf Pro and meets specific compliance requirements. It can also be used to signal the device's compliance state or risk level to drive Risk-based Access to company data. These signals are used to inform policies as defined in the partner's access platform.

Jamf's partner management integrations include:

• AWS Verified Access for macOS
• Device Compliance with Microsoft Entra and Jamf
• Google BeyondCorp Enterprise Integration with Jamf Pro

Enhancing Login Security and End User Experience

As the industry moves towards a password-less future, the foundations for more secure and seamless login capabilities are already here.

See Enhancing and Securing Logins to learn how to not only improve app login security, but dramatically improve user experience as well.

Restricting Access for Anonymous Devices

Upon implementing one or both of the above strategies to identify trusted devices, your next step is to configure applications to only allow connections from these "trusted" devices.

See Restricting Access for Anonymous Devices for details.